Information security of bank non-cash payments. Part 6 - Analysis of banking crimes

(c) the Ministry of Internal Affairs of Russia. Fragment of recording from surveillance cameras at the time of theft of money from an ATM

What research

This article is devoted to the analysis and identification of patterns in crimes aimed at stealing money from banks or their clients.

Further in the article will be presented a sample of more than one hundred real crimes of recent years. All considered crimes will be classified and provided with a brief description. Then a comprehensive analysis will be carried out, according to the results of which the answers to the basic questions of banking security are formulated, in particular:

1. What type of crime is most dangerous for banks?
2. What banking professions are most often involved in criminal activity?
3. Are there any patterns in the actions of criminals, and if so, which ones?
4. … and etc.

ELECTION INFORMATION

Sources and timeframes

Sources of data on the crimes included in the sample were articles on news resources and press releases of law enforcement agencies: the Ministry of Internal Affairs of Russia, the Prosecutor General’s Office of the Russian Federation, the Investigative Committee of the Russian Federation, etc.
')
Given the huge number of "ordinary" crimes, the sample size for them was limited to the last year - from approximately 07.2017 to 07.2018. The time range of the analyzed "computer" crimes is wider - from 2015 to 2018.

Crime classification

From the point of view of banking security, the most important factors in the analysis of crimes will be:

• the number of attackers involved in the crime;
• degree of involvement in the crime of insiders;
• type of crime: "computer" or "normal."

Based on the above, all the crimes in question were classified as follows:

At the beginning they were divided into two types:

1. "Computer" crimes - that is, crimes committed as a result of unauthorized access to information, computer hacks, and so on.
2. “Common” crimes - any other crimes not related to “computer”.

Then the crimes of each type were divided into two categories:

1. Crimes committed with the participation of bank employees. This category will include crimes in which at least one of the criminals is a bank employee.
2. Crimes committed without the participation of bank employees.

Each of the resulting categories, in turn, was divided into two types:

1. Crimes committed by loners.
2. Crimes committed by a group of persons by prior agreement.

The generalized classification scheme is as follows:

"Common" crimes without the participation of bank employees		"Computer" crimes, without the participation of bank employees
Single mother	Group	Single mother	Group
“Common” crimes involving bank employees		"Computer" crimes, with the participation of bank employees
Single mother	Group	Single mother	Group

Data presentation

The description of each crime includes the name and link of the original article, after which a summarized description is given in a table.

Example.

"In Krasnoyarsk, the police detained 15 million rubles from ATMs in the theft of suspects in the theft", - Banks.ru, 2018

Type of crime:	theft of cash from ATMs or payment terminals
Articles of the Criminal Code:	Part 4 of Art. 158
Crime description:	Criminals, using software, opened the payment terminals and stole the money in them.
Damage (million rubles):	15
Maximum punishment (years in prison):	-
Information about criminals:	a criminal group of three men: two 23-year-olds and one 50-year-old

Here:
Type of crime - contains a brief description of the crime.
Articles of the Criminal Code of the Russian Federation - contains a list of articles of the Criminal Code of the Russian Federation for which law enforcement agencies qualified the crime.
Damage (million rubles) - contains the amount of the total damage from a crime, expressed in millions of rubles. If the crime involved amounts in foreign currency, they were converted into rubles at the rate of 60 p. for the US dollar and 70 p. per euro. In cases where the size of the attempted theft is different from the amount of real losses, the first amount is indicated.
Maximum punishment (years in prison) - contains information about the maximum punishment that was imposed on criminals for committing this crime.
Information about criminals - contains a description of the persons who committed the crime.

If the source does not have the required data, then the corresponding column of the description indicates “-”.
Given the huge amount of data, descriptions of all crimes are hidden under spoilers.

Data quality

For an adequate interpretation of the results obtained in this article, the following facts should be considered:

1. In the sample under consideration, there are about hundreds of crimes, while, according to the report of the Ministry of the Interior of Russia “The State of Crime” , thousands of crimes committed under the similar article of the criminal code were committed during the period under review.
2. The sample shows the most resonant crimes.
3. The information sources used do not contain qualitative comprehensive data on crimes.

SELECTION OF CRIMES

“Common” crimes committed by individuals who are not employees of a bank

The main characteristics of crimes

The number of crimes considered - 12.

The minimum damage from a crime is 624 thousand rubles.
The maximum damage from a crime is 8 million rubles.

The minimum penalty for a crime is 3 years of imprisonment.
The maximum penalty for a crime is 10 years of imprisonment.

Crimes committed by women:

• credit fraud.

Crimes committed by men:

• theft of cash from ATMs or payment terminals;
• robbery at a bank branch.

Crime analysis

The main crimes in this group are crimes related to the manifestation of violence, namely robbery attacks on bank branches and physical hacking of ATMs. These crimes were usually committed by men 30-40 years old, and two cases deserve special attention. The first is a crime committed by a former employee of the FPS, and the second is a robbery committed by a former fitness trainer. If the first case is indicative of the fact that the crime was committed by a person who was called to defend the law, the second case partly resembles the plot of the film “Blood and then: Anabolics” , where the main offender was also a fitness trainer, although he robbed customer
Female criminals, unlike men, as a rule, do not commit crimes related to violence. Instead, they use cunning and deceit. So the only crime in this group, committed by a woman, is credit fraud, in particular, registration of fictitious loans based on stolen personal data of individuals.

“Common” crimes committed by individuals employed by a bank

The main characteristics of crimes

The number of considered crimes - 22.

The minimum damage from a crime - 172 thousand rubles.
The maximum damage from a crime is 1 billion rubles.

The minimum penalty for a crime is 2 years of imprisonment.
The maximum penalty for a crime is 4 years of imprisonment.

Crimes committed by women:

• unauthorized transfers (debiting) from accounts of bank customers;
• theft of cash from the bank;
• credit fraud;
• securities fraud;
• theft of bank money.

Crimes committed by men:

• theft of cash from the bank;
• unauthorized transfers (debiting) from accounts of bank customers;
• cash theft during collection;
• credit fraud.

Post criminals:

• bank owner;
• deputy chairman of the bank;
• bank branch director;
• branch manager;
• and about. manager of the operational office of the bank;
• Head of Corporate Banking;
• cashier;
• Client manager;
• financial expert;
• collection officer;
• bank manager;
• employee of the bank.

Crime analysis

The following typical scenarios can be distinguished in the crimes of this group:

1. Lower-level bank managers are engaged in fraud with loans or securities, as well as stealing money from customer accounts.
2. Cashiers or collectors steal money entrusted to them.
3. Top managers of a bank steal money by embezzling or issuing knowingly bad loans.

An interesting fact is that in this group the overwhelming number of criminals are women, and their behavior can be divided into two archetypes:

1. "Tihushnitsy" - work and secretly steal for years.
2. “Desperate” - commit one or more thefts and start running.

In the list of crimes of this group there is a case that is not relevant to the analyzed banking crimes, but still quite interesting. This is a case in which a bank clerk “leaked” a customer database, and then tried to sell it. True, he was caught red-handed.

“Common” crimes committed by groups of persons without the participation of bank employees

The main characteristics of crimes

The number of considered crimes - 19.

The minimum damage from a crime - 1 million 100 thousand rubles.
The maximum damage from a crime is 4.5 billion rubles.

The minimum penalty for a crime is 4.5 years in prison.
The maximum penalty for a crime is 14 years imprisonment.

Crimes committed by women:

• unauthorized transfers (debiting) from accounts of bank customers;
• credit fraud.

Crimes committed by men:

• credit fraud;
• theft of bank money;
• robbery at a bank branch.

The maximum size of a criminal group is 7 participants.

Crime analysis

If we compare the structure of the crimes of this group with the structure of similar crimes, but committed by individuals, we can see a significant shift from crimes related to violence to intellectual crimes related to fraud. In addition to changes in the structure, the damage from crime has increased. This group contains:

• the crime that caused the maximum damage in comparison with other crimes: 4.5 billion rubles;
• the crime for which the maximum penalty is imposed: 14 years imprisonment.

The interesting crimes in this group include fraud committed in Chuvashia. Here, the criminals used the classic “lost wallet” layout, during which they physically stole victims ’bank cards and, using previously watched PIN codes, removed money from them at ATMs. To prevent the victim from suspecting the theft, the criminals slipped a plastic disc instead of a real card.

“Common” crimes committed by groups of persons with the participation of bank employees

The main characteristics of crimes

The number of considered crimes - 20.

The minimum damage from a crime - 1 million 600 thousand rubles.
The maximum damage from a crime is 2 billion 100 million rubles.

The minimum penalty for a crime is 2.5 years of imprisonment.
The maximum penalty for a crime is 12 years in prison.

Crimes committed by women:

• unauthorized transfers (debiting) from accounts of bank customers;
• credit fraud.

Crimes committed by men:

• credit fraud;
• unauthorized transfers (debiting) from accounts of bank customers;
• theft of cash from ATMs or payment terminals.

The maximum size of a criminal group is 8 participants.

Post criminals:

• Chairman of the Board of Directors of the Bank;
• bank president;
• chairman of the bank;
• deputy ;
• - ;
• ;
• ;
• - ;
• deputy ;
• ;
• ;
• - ;
• ;
• ;
• .

The main difference between the crimes of this group and the ones considered earlier is that in the overwhelming majority of cases the affected party is a bank, and the main method of causing damage is the issuance of deliberately bad loans. In addition to credit fraud, the attackers also hunted clients for theft of money in various ways. The cadre composition of criminals is quite remarkable: among them there are many middle and top managers, as well as owners of banks.

The most interesting crime in this group can be considered a combination in which the attackers first gained control of the bank, and then, by issuing non-repayable loans, withdrawn money from it, which ultimately caused damage in more than 2 billion rubles.

"Computer" crimes committed by individuals who are not employees of the bank

The main characteristics of crimes

The number of considered crimes - 6.

The minimum damage from a crime - 120 thousand rubles.
The maximum damage from a crime is 27 million rubles.

The minimum penalty for a crime is no data.
The maximum penalty for a crime is no data.

Crimes committed by women - not recorded.

Crimes committed by men:

• theft of bank money;
• unauthorized transfers (debiting) from accounts of bank customers;
• theft of cash from ATMs or payment terminals.

Crime analysis

“Computer” crimes committed by singles are mainly directed against the bank’s clients and consist of stealing the victims ’money through the Internet Client-Bank systems and performing unauthorized operations on their payment cards.

In addition to attacks on clients, lone hackers stole money from ATMs, as well as in the case of Texbank, tried to steal money by hacking the bank's IT systems.

Noteworthy is the fact that there are no women among the criminals.

"Computer" crimes committed by a group of persons, which included bank employees

The main characteristics of crimes

The number of crimes considered is 2.

The minimum damage from a crime is 6 million rubles.
The maximum damage from a crime is 20 million rubles.

The minimum penalty for a crime is no data.
The maximum penalty for a crime is no data.

Crimes committed by women:

• unauthorized transfers (debiting) from accounts of bank customers.

Crimes committed by men:

• unauthorized transfers (debiting) from accounts of bank customers.

The maximum size of a criminal group is 10 participants.

Post criminals:

• leading bank manager.

Types of crimes - unauthorized transfers (debiting) from the accounts of bank customers.

Crime analysis

“Computer” crimes committed with the participation of bank employees are rare. There are only two in our sample. And all this is the actions of criminal groups. There are no computer crimes committed by singles at all.

In all the crimes of this group, the attackers tried to steal customers' funds. Both men and women participated in the crimes. Also striking is the fact that there are no banking IT-specialists among the criminals.

"Computer" crimes committed by groups of persons without the participation of bank employees

The main characteristics of crimes

The number of considered crimes - 28.

The minimum damage from a crime is 660 thousand rubles.
The maximum damage from a crime is 2 billion rubles.

The minimum penalty for a crime is 5 years of imprisonment.
The maximum penalty for a crime is 8 years of imprisonment.

Crimes committed by women:

• unauthorized transfers (debiting) from accounts of bank customers.

Crimes committed by men:

• unauthorized transfers (debiting) from accounts of bank customers;
• unauthorized transfers from bank accounts;
• theft of cash from ATMs or payment terminals.

The maximum size of a criminal group is 50 participants.

Crime analysis

The crimes of this group are classic hacker crimes, among which are the following typical scenarios:

1. Theft of cash from ATMs by running malware on them.
2. Theft of bank money due to the implementation of attacks like "cancel the transaction" in international payment systems (IPS).
3. Theft of bank money by hacking into its corporate network and making unauthorized transfers from its correspondent accounts.
4. Theft of clients' money by obtaining their details of access to remote banking systems.

The type of crimes and the damage caused by them to a greater extent depends on their qualifications and less on the number of groups that committed them.

For example, there are crimes committed by a group of 5 participants, as a result of which 3 million rubles were stolen, and there are crimes committed by 2 bandits, but causing damage to 60 million rubles. At the same time, the maximum damage was caused by the actions of professional criminal groups with dozens of participants. These gangs can be called “hacker enterprises”, since they committed so many crimes that they even posted job vacancies to fulfill all their plans.

Among all the crimes considered, one can single out the actions of a criminal group of two women and their accomplice - men who robbed Sberbank clients. It is of interest that the criminals were not particularly gifted hackers who were developing sophisticated Trojans or using 0-day exploits; instead, they rummaged in garbage bins next to Sberbank ATMs, found checks containing access details to a bank account, and then made unauthorized transfers using standard Sberbank.Online funds.

TOTAL ANALYSIS OF ALL CRIMES

Up to this point we have analyzed crimes by groups, now we will conduct a generalized analysis of all crimes in the sample.

Crime reports

Note. When calculating damage from crimes involving several types of illegal actions (for example, credit fraud and unauthorized transfers from bank accounts), the total damage is evenly distributed across all types.

In terms of the total number of TOP-3 types of crimes will be:

1. unauthorized transfers (debiting) from accounts of bank customers (29.1%);
2. credit fraud (20.9%);
3. theft of cash from ATMs or payment terminals (12.7%);
   robbery at a bank branch (12.7%);

From the point of view of the total amount of damage, the TOP-3 types of crimes will be:

1. credit fraud (44.3%);
2. unauthorized transfers from bank accounts (23.2%);
3. securities fraud (14.8%)

The most dangerous type of crime is “credit fraud” , as it ranks first in terms of damage and second in terms of the number of crimes committed.



The crime that caused the maximum damage was securities fraud, which caused Otkritie Bank losses of 4.5 billion rubles.

The crime for which the maximum punishment was imposed - robbery attacks on bank branches in the Sverdlovsk region, for which one of the bandits was deprived of their liberty for 14 years.

The maximum amount of cash that the criminals have stolen is 780 million rubles (the former owner of Ergobank stole from the cash register).

The maximum amount of cash stolen by criminals who are not employees of the bank is 23 million rubles (robbery to a branch of the Moscow Bank).

The maximum amount of money stolen by hackers due to the hacking of the bank's IT systems is difficult to reliably determine, since the size of the theft attempts and the amount of the money actually stolen are always different. The maximum attempted theft - 1 billion 400 million rubles (an attempt to steal from the bank "Ring of the Urals"). There is no reliable information about the amount of money actually stolen.

Personnel Risks

Positions of criminals who are employees (or owners) of a bank:

• bank owner;
• Chairman of the Board of Directors of the Bank;
• bank president;
• chairman of the bank;
• deputy chairman of the bank;
• bank vice president;
• Director of the regional branch of the bank;
• bank branch director;
• branch manager;
• additional office manager;
• and about. manager of the operational office of the bank;
• Head of Credit and Deposit Department;
• Head of Small Business Lending;
• Head of Corporate Banking;
• chief economist of the additional office;
• manager-consultant of the bank branch sales department;
• Sales Manager;
• leading bank manager;
• bank manager;
• Client manager;
• financial expert;
• cashier;
• collection officer.

To answer the question, which of the employees is the most dangerous for the bank is definitely not possible. The following patterns can be distinguished:

1. Everyone steals where he can steal. Top management of the bank steals from the bank. Lower level specialists steal mainly from customers. Middle managers steal from customers and the bank.
2. Top management is less likely to commit crimes, but the damage from them is higher. Middle managers and specialists steal more often, but the damage from thefts is less.
3. Women - junior and middle managers of the bank - are at risk of committing crimes related to fraud or theft of cash.

Information about criminals and patterns in their actions

Crimes committed by women:

• unauthorized transfers (debiting) from accounts of bank customers;
• theft of cash from the bank;
• credit fraud;
• securities fraud;
• theft of bank money.

Crimes committed by men:

• theft of cash from ATMs or payment terminals;
• assault on bank
• theft of cash from the bank;
• unauthorized transfers (debiting) from accounts of bank customers;
• unauthorized transfers from bank accounts
• cash theft during collection;
• credit fraud;
• theft of bank money.

Age of criminals - from 19 to 62 years.

The maximum size of criminal groups is 50 participants.

The analysis of crimes revealed the following patterns:

1. Lone hackers tend to rob clients; hacker groups "work" both on clients and on banks.
3. , , , , .
4. . , , .
5. 25-45 .
6. .

The current situation with “computer” crimes, in which they are highly profitable and poorly disclosed, suggests that in “classical” organized criminal groups (OCG), along with teams engaged in “traditional” crimes (racketeering, drugs, etc.) .), in the near future there will be hacker departments.